TCS says received alerts alleging exposure of some employee data

Tata Consultancy Services (TCS) disclosed on Monday that it received alerts suggesting the exposure of certain employee data. However, the company emphasized that there was no evidence of any impact on customer data or systems. TCS, India's largest IT services provider, stated that it conducted an investigation but found no credible evidence of a breach in its own systems or customer environments.

The information cited in the alerts appeared to be outdated, dating back more than four years, and mainly comprised basic employee data, according to TCS. The company did not disclose further details about the timing or the source of the alert. TCS claimed that it had implemented safeguards against the specific attack method, which reportedly utilized password spraying and multifactor authentication fatigue, for over two years.

The company affirmed that its operational systems remained unaffected. TCS stated that it would continue to monitor the situation and take appropriate action as new information emerged. Cybersecurity experts are increasingly focusing on enhancing cyber resilience among technology service providers as the frequency of data breaches and cyberattacks escalates due to the growing adoption of digital technologies and the expanding use of AI-based agents in businesses.

In April 2025, TCS experienced a major cyber incident when the company's services were disrupted for several weeks by a British retail giant, Marks & Spencer (M&S). M&S reported significant data theft and suspension of online operations, with some estimates placing the cost of the disruption at £300 million. M&S later terminated its contract with TCS citing the incident, although TCS denied any involvement in the cyberattack.